28b9a29e04
easier on bpf verifier with no third case Bug: 263884894 Test: TreeHugger Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: I5076de6f83ba522ed4783bca0a9d7fca4024986a
480 lines
23 KiB
C
480 lines
23 KiB
C
/*
|
|
* Copyright (C) 2018 The Android Open Source Project
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
|
|
// The resulting .o needs to load on the Android T Beta 3 bpfloader
|
|
#define BPFLOADER_MIN_VER BPFLOADER_T_BETA3_VERSION
|
|
|
|
#include <bpf_helpers.h>
|
|
#include <linux/bpf.h>
|
|
#include <linux/if.h>
|
|
#include <linux/if_ether.h>
|
|
#include <linux/if_packet.h>
|
|
#include <linux/in.h>
|
|
#include <linux/in6.h>
|
|
#include <linux/ip.h>
|
|
#include <linux/ipv6.h>
|
|
#include <linux/pkt_cls.h>
|
|
#include <linux/tcp.h>
|
|
#include <stdbool.h>
|
|
#include <stdint.h>
|
|
#include "bpf_net_helpers.h"
|
|
#include "netd.h"
|
|
|
|
// This is defined for cgroup bpf filter only.
|
|
static const int DROP = 0;
|
|
static const int PASS = 1;
|
|
static const int DROP_UNLESS_DNS = 2; // internal to our program
|
|
|
|
// This is used for xt_bpf program only.
|
|
static const int BPF_NOMATCH = 0;
|
|
static const int BPF_MATCH = 1;
|
|
|
|
// Used for 'bool egress'
|
|
static const bool INGRESS = false;
|
|
static const bool EGRESS = true;
|
|
|
|
#define IP_PROTO_OFF offsetof(struct iphdr, protocol)
|
|
#define IPV6_PROTO_OFF offsetof(struct ipv6hdr, nexthdr)
|
|
|
|
// offsetof(struct iphdr, ihl) -- but that's a bitfield
|
|
#define IPPROTO_IHL_OFF 0
|
|
|
|
// This is offsetof(struct tcphdr, "32 bit tcp flag field")
|
|
// The tcp flags are after be16 source, dest & be32 seq, ack_seq, hence 12 bytes in.
|
|
//
|
|
// Note that TCP_FLAG_{ACK,PSH,RST,SYN,FIN} are htonl(0x00{10,08,04,02,01}0000)
|
|
// see include/uapi/linux/tcp.h
|
|
#define TCP_FLAG32_OFF 12
|
|
|
|
// For maps netd does not need to access
|
|
#define DEFINE_BPF_MAP_NO_NETD(the_map, TYPE, TypeOfKey, TypeOfValue, num_entries) \
|
|
DEFINE_BPF_MAP_EXT(the_map, TYPE, TypeOfKey, TypeOfValue, num_entries, \
|
|
AID_ROOT, AID_NET_BW_ACCT, 0060, "fs_bpf_net_shared", "", false)
|
|
|
|
// For maps netd only needs read only access to
|
|
#define DEFINE_BPF_MAP_RO_NETD(the_map, TYPE, TypeOfKey, TypeOfValue, num_entries) \
|
|
DEFINE_BPF_MAP_EXT(the_map, TYPE, TypeOfKey, TypeOfValue, num_entries, \
|
|
AID_ROOT, AID_NET_BW_ACCT, 0460, "fs_bpf_netd_readonly", "", false)
|
|
|
|
// For maps netd needs to be able to read and write
|
|
#define DEFINE_BPF_MAP_RW_NETD(the_map, TYPE, TypeOfKey, TypeOfValue, num_entries) \
|
|
DEFINE_BPF_MAP_UGM(the_map, TYPE, TypeOfKey, TypeOfValue, num_entries, \
|
|
AID_ROOT, AID_NET_BW_ACCT, 0660)
|
|
|
|
// Bpf map arrays on creation are preinitialized to 0 and do not support deletion of a key,
|
|
// see: kernel/bpf/arraymap.c array_map_delete_elem() returns -EINVAL (from both syscall and ebpf)
|
|
// Additionally on newer kernels the bpf jit can optimize out the lookups.
|
|
// only valid indexes are [0..CONFIGURATION_MAP_SIZE-1]
|
|
DEFINE_BPF_MAP_RO_NETD(configuration_map, ARRAY, uint32_t, uint32_t, CONFIGURATION_MAP_SIZE)
|
|
|
|
// TODO: consider whether we can merge some of these maps
|
|
// for example it might be possible to merge 2 or 3 of:
|
|
// uid_counterset_map + uid_owner_map + uid_permission_map
|
|
DEFINE_BPF_MAP_RW_NETD(cookie_tag_map, HASH, uint64_t, UidTagValue, COOKIE_UID_MAP_SIZE)
|
|
DEFINE_BPF_MAP_NO_NETD(uid_counterset_map, HASH, uint32_t, uint8_t, UID_COUNTERSET_MAP_SIZE)
|
|
DEFINE_BPF_MAP_NO_NETD(app_uid_stats_map, HASH, uint32_t, StatsValue, APP_STATS_MAP_SIZE)
|
|
DEFINE_BPF_MAP_RW_NETD(stats_map_A, HASH, StatsKey, StatsValue, STATS_MAP_SIZE)
|
|
DEFINE_BPF_MAP_RO_NETD(stats_map_B, HASH, StatsKey, StatsValue, STATS_MAP_SIZE)
|
|
DEFINE_BPF_MAP_NO_NETD(iface_stats_map, HASH, uint32_t, StatsValue, IFACE_STATS_MAP_SIZE)
|
|
DEFINE_BPF_MAP_NO_NETD(uid_owner_map, HASH, uint32_t, UidOwnerValue, UID_OWNER_MAP_SIZE)
|
|
DEFINE_BPF_MAP_RW_NETD(uid_permission_map, HASH, uint32_t, uint8_t, UID_OWNER_MAP_SIZE)
|
|
|
|
/* never actually used from ebpf */
|
|
DEFINE_BPF_MAP_NO_NETD(iface_index_name_map, HASH, uint32_t, IfaceValue, IFACE_INDEX_NAME_MAP_SIZE)
|
|
|
|
// iptables xt_bpf programs need to be usable by both netd and netutils_wrappers
|
|
// selinux contexts, because even non-xt_bpf iptables mutations are implemented as
|
|
// a full table dump, followed by an update in userspace, and then a reload into the kernel,
|
|
// where any already in-use xt_bpf matchers are serialized as the path to the pinned
|
|
// program (see XT_BPF_MODE_PATH_PINNED) and then the iptables binary (or rather
|
|
// the kernel acting on behalf of it) must be able to retrieve the pinned program
|
|
// for the reload to succeed
|
|
#define DEFINE_XTBPF_PROG(SECTION_NAME, prog_uid, prog_gid, the_prog) \
|
|
DEFINE_BPF_PROG(SECTION_NAME, prog_uid, prog_gid, the_prog)
|
|
|
|
// programs that need to be usable by netd, but not by netutils_wrappers
|
|
// (this is because these are currently attached by the mainline provided libnetd_updatable .so
|
|
// which is loaded into netd and thus runs as netd uid/gid/selinux context)
|
|
#define DEFINE_NETD_BPF_PROG_KVER_RANGE(SECTION_NAME, prog_uid, prog_gid, the_prog, minKV, maxKV) \
|
|
DEFINE_BPF_PROG_EXT(SECTION_NAME, prog_uid, prog_gid, the_prog, \
|
|
minKV, maxKV, false, "fs_bpf_netd_readonly", "")
|
|
|
|
#define DEFINE_NETD_BPF_PROG_KVER(SECTION_NAME, prog_uid, prog_gid, the_prog, min_kv) \
|
|
DEFINE_NETD_BPF_PROG_KVER_RANGE(SECTION_NAME, prog_uid, prog_gid, the_prog, min_kv, KVER_INF)
|
|
|
|
#define DEFINE_NETD_BPF_PROG(SECTION_NAME, prog_uid, prog_gid, the_prog) \
|
|
DEFINE_NETD_BPF_PROG_KVER(SECTION_NAME, prog_uid, prog_gid, the_prog, KVER_NONE)
|
|
|
|
// programs that only need to be usable by the system server
|
|
#define DEFINE_SYS_BPF_PROG(SECTION_NAME, prog_uid, prog_gid, the_prog) \
|
|
DEFINE_BPF_PROG_EXT(SECTION_NAME, prog_uid, prog_gid, the_prog, \
|
|
KVER_NONE, KVER_INF, false, "fs_bpf_net_shared", "")
|
|
|
|
static __always_inline int is_system_uid(uint32_t uid) {
|
|
// MIN_SYSTEM_UID is AID_ROOT == 0, so uint32_t is *always* >= 0
|
|
// MAX_SYSTEM_UID is AID_NOBODY == 9999, while AID_APP_START == 10000
|
|
return (uid < AID_APP_START);
|
|
}
|
|
|
|
/*
|
|
* Note: this blindly assumes an MTU of 1500, and that packets > MTU are always TCP,
|
|
* and that TCP is using the Linux default settings with TCP timestamp option enabled
|
|
* which uses 12 TCP option bytes per frame.
|
|
*
|
|
* These are not unreasonable assumptions:
|
|
*
|
|
* The internet does not really support MTUs greater than 1500, so most TCP traffic will
|
|
* be at that MTU, or slightly below it (worst case our upwards adjustment is too small).
|
|
*
|
|
* The chance our traffic isn't IP at all is basically zero, so the IP overhead correction
|
|
* is bound to be needed.
|
|
*
|
|
* Furthermore, the likelyhood that we're having to deal with GSO (ie. > MTU) packets that
|
|
* are not IP/TCP is pretty small (few other things are supported by Linux) and worse case
|
|
* our extra overhead will be slightly off, but probably still better than assuming none.
|
|
*
|
|
* Most servers are also Linux and thus support/default to using TCP timestamp option
|
|
* (and indeed TCP timestamp option comes from RFC 1323 titled "TCP Extensions for High
|
|
* Performance" which also defined TCP window scaling and are thus absolutely ancient...).
|
|
*
|
|
* All together this should be more correct than if we simply ignored GSO frames
|
|
* (ie. counted them as single packets with no extra overhead)
|
|
*
|
|
* Especially since the number of packets is important for any future clat offload correction.
|
|
* (which adjusts upward by 20 bytes per packet to account for ipv4 -> ipv6 header conversion)
|
|
*/
|
|
#define DEFINE_UPDATE_STATS(the_stats_map, TypeOfKey) \
|
|
static __always_inline inline void update_##the_stats_map(struct __sk_buff* skb, \
|
|
bool egress, TypeOfKey* key) { \
|
|
StatsValue* value = bpf_##the_stats_map##_lookup_elem(key); \
|
|
if (!value) { \
|
|
StatsValue newValue = {}; \
|
|
bpf_##the_stats_map##_update_elem(key, &newValue, BPF_NOEXIST); \
|
|
value = bpf_##the_stats_map##_lookup_elem(key); \
|
|
} \
|
|
if (value) { \
|
|
const int mtu = 1500; \
|
|
uint64_t packets = 1; \
|
|
uint64_t bytes = skb->len; \
|
|
if (bytes > mtu) { \
|
|
bool is_ipv6 = (skb->protocol == htons(ETH_P_IPV6)); \
|
|
int ip_overhead = (is_ipv6 ? sizeof(struct ipv6hdr) : sizeof(struct iphdr)); \
|
|
int tcp_overhead = ip_overhead + sizeof(struct tcphdr) + 12; \
|
|
int mss = mtu - tcp_overhead; \
|
|
uint64_t payload = bytes - tcp_overhead; \
|
|
packets = (payload + mss - 1) / mss; \
|
|
bytes = tcp_overhead * packets + payload; \
|
|
} \
|
|
if (egress) { \
|
|
__sync_fetch_and_add(&value->txPackets, packets); \
|
|
__sync_fetch_and_add(&value->txBytes, bytes); \
|
|
} else { \
|
|
__sync_fetch_and_add(&value->rxPackets, packets); \
|
|
__sync_fetch_and_add(&value->rxBytes, bytes); \
|
|
} \
|
|
} \
|
|
}
|
|
|
|
DEFINE_UPDATE_STATS(app_uid_stats_map, uint32_t)
|
|
DEFINE_UPDATE_STATS(iface_stats_map, uint32_t)
|
|
DEFINE_UPDATE_STATS(stats_map_A, StatsKey)
|
|
DEFINE_UPDATE_STATS(stats_map_B, StatsKey)
|
|
|
|
// both of these return 0 on success or -EFAULT on failure (and zero out the buffer)
|
|
static __always_inline inline int bpf_skb_load_bytes_net(const struct __sk_buff* skb, int off,
|
|
void* to, int len, bool is_4_19) {
|
|
return is_4_19
|
|
? bpf_skb_load_bytes_relative(skb, off, to, len, BPF_HDR_START_NET)
|
|
: bpf_skb_load_bytes(skb, off, to, len);
|
|
}
|
|
|
|
static __always_inline inline bool skip_owner_match(struct __sk_buff* skb, bool is_4_19) {
|
|
uint32_t flag = 0;
|
|
if (skb->protocol == htons(ETH_P_IP)) {
|
|
uint8_t proto;
|
|
// no need to check for success, proto will be zeroed if bpf_skb_load_bytes_net() fails
|
|
(void)bpf_skb_load_bytes_net(skb, IP_PROTO_OFF, &proto, sizeof(proto), is_4_19);
|
|
if (proto == IPPROTO_ESP) return true;
|
|
if (proto != IPPROTO_TCP) return false; // handles read failure above
|
|
uint8_t ihl;
|
|
// we don't check for success, as this cannot fail, as it is earlier in the packet than
|
|
// proto, the reading of which must have succeeded, additionally the next read
|
|
// (a little bit deeper in the packet in spite of ihl being zeroed) of the tcp flags
|
|
// field will also fail, and that failure we already handle correctly
|
|
// (we also don't check that ihl in [0x45,0x4F] nor that ipv4 header checksum is correct)
|
|
(void)bpf_skb_load_bytes_net(skb, IPPROTO_IHL_OFF, &ihl, sizeof(ihl), is_4_19);
|
|
// if the read below fails, we'll just assume no TCP flags are set, which is fine.
|
|
(void)bpf_skb_load_bytes_net(skb, (ihl & 0xF) * 4 + TCP_FLAG32_OFF,
|
|
&flag, sizeof(flag), is_4_19);
|
|
} else if (skb->protocol == htons(ETH_P_IPV6)) {
|
|
uint8_t proto;
|
|
// no need to check for success, proto will be zeroed if bpf_skb_load_bytes_net() fails
|
|
(void)bpf_skb_load_bytes_net(skb, IPV6_PROTO_OFF, &proto, sizeof(proto), is_4_19);
|
|
if (proto == IPPROTO_ESP) return true;
|
|
if (proto != IPPROTO_TCP) return false; // handles read failure above
|
|
// if the read below fails, we'll just assume no TCP flags are set, which is fine.
|
|
(void)bpf_skb_load_bytes_net(skb, sizeof(struct ipv6hdr) + TCP_FLAG32_OFF,
|
|
&flag, sizeof(flag), is_4_19);
|
|
} else {
|
|
return false;
|
|
}
|
|
return flag & TCP_FLAG_RST; // false on read failure
|
|
}
|
|
|
|
static __always_inline inline BpfConfig getConfig(uint32_t configKey) {
|
|
uint32_t mapSettingKey = configKey;
|
|
BpfConfig* config = bpf_configuration_map_lookup_elem(&mapSettingKey);
|
|
if (!config) {
|
|
// Couldn't read configuration entry. Assume everything is disabled.
|
|
return DEFAULT_CONFIG;
|
|
}
|
|
return *config;
|
|
}
|
|
|
|
// DROP_IF_SET is set of rules that DROP if rule is globally enabled, and per-uid bit is set
|
|
#define DROP_IF_SET (STANDBY_MATCH | OEM_DENY_1_MATCH | OEM_DENY_2_MATCH | OEM_DENY_3_MATCH)
|
|
// DROP_IF_UNSET is set of rules that should DROP if globally enabled, and per-uid bit is NOT set
|
|
#define DROP_IF_UNSET (DOZABLE_MATCH | POWERSAVE_MATCH | RESTRICTED_MATCH | LOW_POWER_STANDBY_MATCH)
|
|
|
|
static __always_inline inline int bpf_owner_match(struct __sk_buff* skb, uint32_t uid,
|
|
bool egress, bool is_4_19) {
|
|
if (skip_owner_match(skb, is_4_19)) return PASS;
|
|
|
|
if (is_system_uid(uid)) return PASS;
|
|
|
|
BpfConfig enabledRules = getConfig(UID_RULES_CONFIGURATION_KEY);
|
|
|
|
UidOwnerValue* uidEntry = bpf_uid_owner_map_lookup_elem(&uid);
|
|
uint32_t uidRules = uidEntry ? uidEntry->rule : 0;
|
|
uint32_t allowed_iif = uidEntry ? uidEntry->iif : 0;
|
|
|
|
// Warning: funky bit-wise arithmetic: in parallel, for all DROP_IF_SET/UNSET rules
|
|
// check whether the rules are globally enabled, and if so whether the rules are
|
|
// set/unset for the specific uid. DROP if that is the case for ANY of the rules.
|
|
// We achieve this by masking out only the bits/rules we're interested in checking,
|
|
// and negating (via bit-wise xor) the bits/rules that should drop if unset.
|
|
if (enabledRules & (DROP_IF_SET | DROP_IF_UNSET) & (uidRules ^ DROP_IF_UNSET)) return DROP;
|
|
|
|
if (!egress && skb->ifindex != 1) {
|
|
if (uidRules & IIF_MATCH) {
|
|
if (allowed_iif && skb->ifindex != allowed_iif) {
|
|
// Drops packets not coming from lo nor the allowed interface
|
|
// allowed interface=0 is a wildcard and does not drop packets
|
|
return DROP_UNLESS_DNS;
|
|
}
|
|
} else if (uidRules & LOCKDOWN_VPN_MATCH) {
|
|
// Drops packets not coming from lo and rule does not have IIF_MATCH but has
|
|
// LOCKDOWN_VPN_MATCH
|
|
return DROP_UNLESS_DNS;
|
|
}
|
|
}
|
|
return PASS;
|
|
}
|
|
|
|
static __always_inline inline void update_stats_with_config(struct __sk_buff* skb, bool egress,
|
|
StatsKey* key, uint32_t selectedMap) {
|
|
if (selectedMap == SELECT_MAP_A) {
|
|
update_stats_map_A(skb, egress, key);
|
|
} else {
|
|
update_stats_map_B(skb, egress, key);
|
|
}
|
|
}
|
|
|
|
static __always_inline inline int bpf_traffic_account(struct __sk_buff* skb, bool egress,
|
|
bool is_4_19) {
|
|
uint32_t sock_uid = bpf_get_socket_uid(skb);
|
|
uint64_t cookie = bpf_get_socket_cookie(skb);
|
|
UidTagValue* utag = bpf_cookie_tag_map_lookup_elem(&cookie);
|
|
uint32_t uid, tag;
|
|
if (utag) {
|
|
uid = utag->uid;
|
|
tag = utag->tag;
|
|
} else {
|
|
uid = sock_uid;
|
|
tag = 0;
|
|
}
|
|
|
|
// Always allow and never count clat traffic. Only the IPv4 traffic on the stacked
|
|
// interface is accounted for and subject to usage restrictions.
|
|
// TODO: remove sock_uid check once Nat464Xlat javaland adds the socket tag AID_CLAT for clat.
|
|
if (sock_uid == AID_CLAT || uid == AID_CLAT) {
|
|
return PASS;
|
|
}
|
|
|
|
int match = bpf_owner_match(skb, sock_uid, egress, is_4_19);
|
|
if (egress && (match == DROP)) {
|
|
// If an outbound packet is going to be dropped, we do not count that
|
|
// traffic.
|
|
return match;
|
|
}
|
|
|
|
// Workaround for secureVPN with VpnIsolation enabled, refer to b/159994981 for details.
|
|
// Keep TAG_SYSTEM_DNS in sync with DnsResolver/include/netd_resolv/resolv.h
|
|
// and TrafficStatsConstants.java
|
|
#define TAG_SYSTEM_DNS 0xFFFFFF82
|
|
if (tag == TAG_SYSTEM_DNS && uid == AID_DNS) {
|
|
uid = sock_uid;
|
|
if (match == DROP_UNLESS_DNS) match = PASS;
|
|
} else {
|
|
if (match == DROP_UNLESS_DNS) match = DROP;
|
|
}
|
|
|
|
StatsKey key = {.uid = uid, .tag = tag, .counterSet = 0, .ifaceIndex = skb->ifindex};
|
|
|
|
uint8_t* counterSet = bpf_uid_counterset_map_lookup_elem(&uid);
|
|
if (counterSet) key.counterSet = (uint32_t)*counterSet;
|
|
|
|
uint32_t mapSettingKey = CURRENT_STATS_MAP_CONFIGURATION_KEY;
|
|
uint32_t* selectedMap = bpf_configuration_map_lookup_elem(&mapSettingKey);
|
|
|
|
// Use asm("%0 &= 1" : "+r"(match)) before return match,
|
|
// to help kernel's bpf verifier, so that it can be 100% certain
|
|
// that the returned value is always BPF_NOMATCH(0) or BPF_MATCH(1).
|
|
if (!selectedMap) {
|
|
asm("%0 &= 1" : "+r"(match));
|
|
return match;
|
|
}
|
|
|
|
if (key.tag) {
|
|
update_stats_with_config(skb, egress, &key, *selectedMap);
|
|
key.tag = 0;
|
|
}
|
|
|
|
update_stats_with_config(skb, egress, &key, *selectedMap);
|
|
update_app_uid_stats_map(skb, egress, &uid);
|
|
asm("%0 &= 1" : "+r"(match));
|
|
return match;
|
|
}
|
|
|
|
DEFINE_NETD_BPF_PROG_KVER_RANGE("cgroupskb/ingress/stats$4_19", AID_ROOT, AID_SYSTEM,
|
|
bpf_cgroup_ingress_4_19, KVER(4, 19, 0), KVER_INF)
|
|
(struct __sk_buff* skb) {
|
|
return bpf_traffic_account(skb, INGRESS, /* is_4_19 */ true);
|
|
}
|
|
|
|
DEFINE_NETD_BPF_PROG_KVER_RANGE("cgroupskb/ingress/stats$4_14", AID_ROOT, AID_SYSTEM,
|
|
bpf_cgroup_ingress_4_14, KVER_NONE, KVER(4, 19, 0))
|
|
(struct __sk_buff* skb) {
|
|
return bpf_traffic_account(skb, INGRESS, /* is_4_19 */ false);
|
|
}
|
|
|
|
DEFINE_NETD_BPF_PROG_KVER_RANGE("cgroupskb/egress/stats$4_19", AID_ROOT, AID_SYSTEM,
|
|
bpf_cgroup_egress_4_19, KVER(4, 19, 0), KVER_INF)
|
|
(struct __sk_buff* skb) {
|
|
return bpf_traffic_account(skb, EGRESS, /* is_4_19 */ true);
|
|
}
|
|
|
|
DEFINE_NETD_BPF_PROG_KVER_RANGE("cgroupskb/egress/stats$4_14", AID_ROOT, AID_SYSTEM,
|
|
bpf_cgroup_egress_4_14, KVER_NONE, KVER(4, 19, 0))
|
|
(struct __sk_buff* skb) {
|
|
return bpf_traffic_account(skb, EGRESS, /* is_4_19 */ false);
|
|
}
|
|
|
|
// WARNING: Android T's non-updatable netd depends on the name of this program.
|
|
DEFINE_XTBPF_PROG("skfilter/egress/xtbpf", AID_ROOT, AID_NET_ADMIN, xt_bpf_egress_prog)
|
|
(struct __sk_buff* skb) {
|
|
// Clat daemon does not generate new traffic, all its traffic is accounted for already
|
|
// on the v4-* interfaces (except for the 20 (or 28) extra bytes of IPv6 vs IPv4 overhead,
|
|
// but that can be corrected for later when merging v4-foo stats into interface foo's).
|
|
// TODO: remove sock_uid check once Nat464Xlat javaland adds the socket tag AID_CLAT for clat.
|
|
uint32_t sock_uid = bpf_get_socket_uid(skb);
|
|
if (sock_uid == AID_CLAT) return BPF_NOMATCH;
|
|
if (sock_uid == AID_SYSTEM) {
|
|
uint64_t cookie = bpf_get_socket_cookie(skb);
|
|
UidTagValue* utag = bpf_cookie_tag_map_lookup_elem(&cookie);
|
|
if (utag && utag->uid == AID_CLAT) return BPF_NOMATCH;
|
|
}
|
|
|
|
uint32_t key = skb->ifindex;
|
|
update_iface_stats_map(skb, EGRESS, &key);
|
|
return BPF_MATCH;
|
|
}
|
|
|
|
// WARNING: Android T's non-updatable netd depends on the name of this program.
|
|
DEFINE_XTBPF_PROG("skfilter/ingress/xtbpf", AID_ROOT, AID_NET_ADMIN, xt_bpf_ingress_prog)
|
|
(struct __sk_buff* skb) {
|
|
// Clat daemon traffic is not accounted by virtue of iptables raw prerouting drop rule
|
|
// (in clat_raw_PREROUTING chain), which triggers before this (in bw_raw_PREROUTING chain).
|
|
// It will be accounted for on the v4-* clat interface instead.
|
|
// Keep that in mind when moving this out of iptables xt_bpf and into tc ingress (or xdp).
|
|
|
|
uint32_t key = skb->ifindex;
|
|
update_iface_stats_map(skb, INGRESS, &key);
|
|
return BPF_MATCH;
|
|
}
|
|
|
|
DEFINE_SYS_BPF_PROG("schedact/ingress/account", AID_ROOT, AID_NET_ADMIN,
|
|
tc_bpf_ingress_account_prog)
|
|
(struct __sk_buff* skb) {
|
|
if (is_received_skb(skb)) {
|
|
// Account for ingress traffic before tc drops it.
|
|
uint32_t key = skb->ifindex;
|
|
update_iface_stats_map(skb, INGRESS, &key);
|
|
}
|
|
return TC_ACT_UNSPEC;
|
|
}
|
|
|
|
// WARNING: Android T's non-updatable netd depends on the name of this program.
|
|
DEFINE_XTBPF_PROG("skfilter/allowlist/xtbpf", AID_ROOT, AID_NET_ADMIN, xt_bpf_allowlist_prog)
|
|
(struct __sk_buff* skb) {
|
|
uint32_t sock_uid = bpf_get_socket_uid(skb);
|
|
if (is_system_uid(sock_uid)) return BPF_MATCH;
|
|
|
|
// 65534 is the overflow 'nobody' uid, usually this being returned means
|
|
// that skb->sk is NULL during RX (early decap socket lookup failure),
|
|
// which commonly happens for incoming packets to an unconnected udp socket.
|
|
// Additionally bpf_get_socket_cookie() returns 0 if skb->sk is NULL
|
|
if ((sock_uid == 65534) && !bpf_get_socket_cookie(skb) && is_received_skb(skb))
|
|
return BPF_MATCH;
|
|
|
|
UidOwnerValue* allowlistMatch = bpf_uid_owner_map_lookup_elem(&sock_uid);
|
|
if (allowlistMatch) return allowlistMatch->rule & HAPPY_BOX_MATCH ? BPF_MATCH : BPF_NOMATCH;
|
|
return BPF_NOMATCH;
|
|
}
|
|
|
|
// WARNING: Android T's non-updatable netd depends on the name of this program.
|
|
DEFINE_XTBPF_PROG("skfilter/denylist/xtbpf", AID_ROOT, AID_NET_ADMIN, xt_bpf_denylist_prog)
|
|
(struct __sk_buff* skb) {
|
|
uint32_t sock_uid = bpf_get_socket_uid(skb);
|
|
UidOwnerValue* denylistMatch = bpf_uid_owner_map_lookup_elem(&sock_uid);
|
|
if (denylistMatch) return denylistMatch->rule & PENALTY_BOX_MATCH ? BPF_MATCH : BPF_NOMATCH;
|
|
return BPF_NOMATCH;
|
|
}
|
|
|
|
DEFINE_NETD_BPF_PROG_KVER("cgroupsock/inet/create", AID_ROOT, AID_ROOT, inet_socket_create,
|
|
KVER(4, 14, 0))
|
|
(struct bpf_sock* sk) {
|
|
uint64_t gid_uid = bpf_get_current_uid_gid();
|
|
/*
|
|
* A given app is guaranteed to have the same app ID in all the profiles in
|
|
* which it is installed, and install permission is granted to app for all
|
|
* user at install time so we only check the appId part of a request uid at
|
|
* run time. See UserHandle#isSameApp for detail.
|
|
*/
|
|
uint32_t appId = (gid_uid & 0xffffffff) % AID_USER_OFFSET; // == PER_USER_RANGE == 100000
|
|
uint8_t* permissions = bpf_uid_permission_map_lookup_elem(&appId);
|
|
if (!permissions) {
|
|
// UID not in map. Default to just INTERNET permission.
|
|
return 1;
|
|
}
|
|
|
|
// A return value of 1 means allow, everything else means deny.
|
|
return (*permissions & BPF_PERMISSION_INTERNET) == BPF_PERMISSION_INTERNET;
|
|
}
|
|
|
|
LICENSE("Apache 2.0");
|
|
CRITICAL("Connectivity and netd");
|